Glossary
EMAIL AUTH

DKIM

DomainKeys Identified Mail — an email authentication standard that uses public-key cryptography to sign outgoing messages, allowing receivers to verify the email came from the claimed domain and wasn't altered in transit.

DKIM (DomainKeys Identified Mail) adds a cryptographic signature to outgoing email. The sending mail server signs selected headers and the message body using a private key. The corresponding public key is published in DNS as a TXT record. Receiving servers fetch the public key and verify the signature — confirming the message is authentic and unmodified.

How It Works

  1. Sending server hashes selected headers + body
  2. Hashes with private key → DKIM-Signature header added to email
  3. Receiving server reads d= domain and s= selector from DKIM-Signature
  4. Looks up selector._domainkey.domain.com in DNS for public key
  5. Decrypts signature, recomputes hash, compares — PASS or FAIL

DNS Record Format

google._domainkey.example.com.  TXT  "v=DKIM1; k=rsa; p=MIGfMA0GCSqG..."

The selector (google) allows multiple keys — one per email service.

Importance

DKIM provides message integrity (wasn’t altered in transit) and signing domain proof (came from a server with the private key). Combined with DMARC alignment, it prevents From: address spoofing. Survives email forwarding better than SPF (which breaks when the envelope changes).

Read what DKIM does in depth, understand how DMARC enforces DKIM, or check the SPF glossary entry — the DKIM partner in email authentication.

← All terms Learning hub →